Systems & architecture
4 posts tagged #nestjs on DiCodeWeb, from fundamentals to production, newest first.
4 postsUpdated Oct 20, 2026
All ten risks of the OWASP API Security Top 10 (2023) worked through in NestJS: ownership checks in scoped repositories, whitelisted DTOs, response shaping, CASL policies, cost-based rate limits, idempotent business flows, SSRF-safe fetch, and an authorization matrix in e2e tests.
An honest authentication design for a NestJS API and a Next.js frontend: when to use sessions, when to use JWT, how to rotate refresh tokens with reuse detection, passkey sign-in with SimpleWebAuthn, and the guards, rate limits and CSRF protection that go with it.
How to build background jobs in NestJS 12 with BullMQ 6 that never silently lose work and never charge a customer twice: at-least-once delivery and idempotency, the transactional outbox, retries with error classification, dead letters, rate limiting, graceful shutdown and observability.
What NestJS does under the hood — the order of middleware, guards, interceptors, pipes and filters; DI, scopes and durable providers; dynamic modules — and how to use it to structure a large API as a clean modular monolith with a consistent error model, request context and graceful shutdown.